Ensure `docker cp` cannot traverse outside container rootfs

This patch fixes the bug (#5656) that allowed cp to copy files outside of the containers rootfs, by passing a relative path (such as `../../../../../../../../etc/shadow`). This is fixed by first converting the path to an absolute path (relative to /) and then appending it to the container's rootfs before continuing.

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)

EDIT: I want to point out that while the issue (#5656) is closed, the vulnerability still works. The problem is that the docker socket can, even when running in multi-tenant situations, be used to read files as root since paths aren't sanitised properly. This problem has yet to be fixed.

EDIT 2: This patch also now includes fixes to general path generation in the `daemon` subsystem, in order to try and prevent future exploits in the same vein as this one.

Fixes #5656 

/cc @shykes @creack @vieux @crosbymichael